Website maintainers should immediately check the PHP environment and apply security fixes. In its 21 October update at 23:00 Latvian time, CERT.LV reported approximately 6000 potentially affected Latvian resources and automated attack attempts. At that point, there were no reports of successful attacks; the figure does not represent compromised websites.
What is the problem, and which businesses are affected?
The technical alert concerns CVE-2026-109618 and CVE-2026-109619, with a CVSS score of 9.2. Under certain conditions, they allow unauthenticated code execution on a server. PHP-powered websites, online shops and customer portals need checking, including systems maintained by external providers.
One issue involves out-of-memory handling; the other involves invalid internal state persisting between requests. An attack before application code runs has been demonstrated for Apache mod_php. PHP-FPM is not a safe exception either; specific exploitability depends on configuration and the application.
Which PHP versions contain fixes?
The PHP developers released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Install the appropriate fix for the environment. PHP 8.1 and older branches no longer receive regular project support; some vendors provide backported fixes. An older displayed version number therefore needs checking against the vendor's security advisory.
Five questions for the website maintenance provider
This editorial checklist turns a general “everything is fine” response into a result that can be verified:
- Which of our systems have been checked? List the main website, shop, subdomains and customer portal. Checking one site does not replace an inventory of the others.
- What proves that both CVEs have been addressed? Request the PHP package version, vendor patch reference and implementation time. Confirmation that only CMS plugins were updated is insufficient.
- Is the fix active throughout the environment handling web requests? Ask for confirmation covering web-request processes and every server. A single command-line check may not represent the entire deployment.
- Does the site work after the change? Test login, the contact form, order creation and file uploads where supported. Record who tested them and when.
- Who checks for signs of an incident? Agree who investigates suspicious events and who receives the findings. Unclear responsibility between the developer and hosting provider must not leave this task undone.
Why does updating not replace an incident review?
Amazon's security team reported an exploitation attempt observed in its honeypots on 17 October. This supports reviewing an earlier period as well. The maintainer should examine logs, unexpected file changes and process activity; applying a patch does not establish that nothing happened beforehand.
The business owner can request a short completion record: systems checked, fix applied, responsible person, verification result and outstanding work. This record also helps with the next security alert because each system's owner does not have to be identified again.
What if a legacy system cannot support the update?
Agree on temporary access restrictions and a specific repair or migration deadline. Configuration changes and filtering do not fully replace a fix. The business needs both protection and a plan for handling orders and customer enquiries during the restriction.
When assessing external providers, explore business listings; for administrative needs, see services for businesses. A particular IT provider's competence and scope of work require a separate assessment.
Comments
No comments yet. Yours could be the first!
Add a comment